Executive brief
A vulnerability in the Linux kernel's crypto component could cause system instability or service disruptions. The issue stems from memory being improperly initialized, which can lead to random errors and failures when applications attempt to use cryptographic functions. This primarily impacts the availability of services relying on the kernel's crypto API, potentially causing legitimate requests to be blocked.
Technical details
A 'Use of Uninitialized Resource' (CWE-908) vulnerability exists in the Linux kernel's crypto/af_alg.c and related user-space interface files (algif_hash.c, algif_rng.c). Several crypto user API contexts and requests allocated with sock_kmalloc() were not zero-initialized, causing fields like 'inflight' to contain garbage values. This results in af_alg_alloc_areq() randomly returning -EBUSY when uninitialized data is interpreted as true, effectively blocking legitimate asynchronous I/O requests. The fix involves explicitly zeroing the allocated memory using memset() before use. Patch commits have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel fe869cdb89c9 to 6f6e309328d53a10c0fe1f77dec2db73373179b6
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-09-23: other: Initial patch authored
- 2026-01-14: advisory: CVE published
References
- https://git.kernel.org/stable/c/51a5ab36084f3251ef87eda3e6a6236f6488925e
- https://git.kernel.org/stable/c/543bf004e4eafbb302b1e6c78570d425d2ca13a0
- https://git.kernel.org/stable/c/5a4b65523608974a81edbe386f8a667a3e10c726
- https://git.kernel.org/stable/c/6f6e309328d53a10c0fe1f77dec2db73373179b6
- https://git.kernel.org/stable/c/84238876e3b3b262cf62d5f4d1338e983fb27010
- https://git.kernel.org/stable/c/e125c8e346e4eb7b3e854c862fcb4392bc13ddba
- https://git.kernel.org/stable/c/f81244fd6b14fecfa93b66b6bb1d59f96554e550